Cross-Site Scripting (XSS) in jquery

Description

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain the dataType option.

Recommendation

Update the jquery package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.12.3, < 3.0.0

  < 1.12.2**

• Patched version(s): **3.0.0

  1.12.2**

References

• GHSA-rmxg-73gg-4p98
• access.redhat.com
• ics-cert.us-cert.gov
• kb.pulsesecure.net
• lists.apache.org
• seclists.org
• security.netapp.com
• snyk.io
• sw.aveva.com
• www.oracle.com
• www.tenable.com
• lists.opensuse.org
• packetstormsecurity.com
• security.snyk.io
• web.archive.org
• CVE-2015-9251
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6